CVE-2026-34180 (GCVE-0-2026-34180)

Vulnerability from cvelistv5 – Published: 2026-06-09 16:03 – Updated: 2026-06-10 07:47
VLAI
Title
Heap Buffer Over-read in ASN.1 Content Parsing
Summary
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder causes the content length of an ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the worst case the truncated length is treated as a request to scan the binary content for a terminating zero byte, possibly causing OpenSSL to read either less than or beyond the end of the allocated buffer. Applications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or any other d2i_* decoding function are affected. OpenSSL's own command-line tools are not vulnerable, as data read through the BIO layer is checked before it reaches the affected code. The issue only affects 64-bit Unix and Unix-like platforms; 32-bit platforms and 64-bit Windows are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 19:00 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
OpenSSL OpenSSL Affected: 4.0.0 , < 4.0.1 (semver)
Affected: 3.6.0 , < 3.6.3 (semver)
Affected: 3.5.0 , < 3.5.7 (semver)
Affected: 3.4.0 , < 3.4.6 (semver)
Affected: 3.0.0 , < 3.0.21 (semver)
Affected: 1.1.1 , < 1.1.1zh (custom)
Affected: 1.0.2 , < 1.0.2zq (custom)
guessed Create a notification for this product.
Date Public
2026-06-09 14:00
Credits
Frank Buss Viktor Dukhovni
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-34180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T19:00:59.503895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T19:02:24.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "lessThan": "4.0.1",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.3",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5.7",
              "status": "affected",
              "version": "3.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.21",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.1.1zh",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.0.2zq",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Frank Buss"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Viktor Dukhovni"
        }
      ],
      "datePublic": "2026-06-09T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\u003cbr\u003eelement whose content exceeds 2 gigabytes in length may cause a heap buffer\u003cbr\u003eover-read on 64-bit Unix and Unix-like platforms.\u003cbr\u003e\u003cbr\u003eImpact summary: The heap buffer over-read may crash the application (Denial of\u003cbr\u003eService) or to load into the decoded ASN.1 object contents of memory beyond the\u003cbr\u003eend of the input buffer.  More typically such ASN.1 elements would instead be\u003cbr\u003etruncated.\u003cbr\u003e\u003cbr\u003eAn integer truncation in OpenSSL\u0027s ASN.1 decoder causes the content length of\u003cbr\u003ean ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\u003cbr\u003eworst case the truncated length is treated as a request to scan the binary\u003cbr\u003econtent for a terminating zero byte, possibly causing OpenSSL to read either\u003cbr\u003eless than or beyond the end of the allocated buffer.\u003cbr\u003e\u003cbr\u003eApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\u003cbr\u003eany other d2i_* decoding function are affected. OpenSSL\u0027s own command-line\u003cbr\u003etools are not vulnerable, as data read through the BIO layer is checked before\u003cbr\u003eit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\u003cbr\u003eplatforms; 32-bit platforms and 64-bit Windows are not affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\u003cbr\u003eas the affected code is outside the OpenSSL FIPS module boundary."
            }
          ],
          "value": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL\u0027s ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL\u0027s own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "Low"
            },
            "type": "https://openssl-library.org/policies/general/security-policy/"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T07:47:52.427Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "OpenSSL Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://openssl-library.org/news/secadv/20260609.txt"
        },
        {
          "name": "4.0.1 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16"
        },
        {
          "name": "3.6.3 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff"
        },
        {
          "name": "3.5.7 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43"
        },
        {
          "name": "3.4.6 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d"
        },
        {
          "name": "3.0.21 git commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Heap Buffer Over-read in ASN.1 Content Parsing",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2026-34180",
    "datePublished": "2026-06-09T16:03:17.082Z",
    "dateReserved": "2026-03-26T09:29:36.012Z",
    "dateUpdated": "2026-06-10T07:47:52.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34180",
      "date": "2026-09-02",
      "epss": "0.01025",
      "percentile": "0.61225"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-23T14:51:11.000Z",
      "cve": "CVE-2026-34180",
      "id": "msrc_CVE-2026-34180",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "7",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Heap Buffer Over-read in ASN.1 Content Parsing",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-34180.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34180\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2026-06-09T17:17:04.600\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\\nover-read on 64-bit Unix and Unix-like platforms.\\n\\nImpact summary: The heap buffer over-read may crash the application (Denial of\\nService) or to load into the decoded ASN.1 object contents of memory beyond the\\nend of the input buffer.  More typically such ASN.1 elements would instead be\\ntruncated.\\n\\nAn integer truncation in OpenSSL\u0027s ASN.1 decoder causes the content length of\\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\\nworst case the truncated length is treated as a request to scan the binary\\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\\nless than or beyond the end of the allocated buffer.\\n\\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\\nany other d2i_* decoding function are affected. OpenSSL\u0027s own command-line\\ntools are not vulnerable, as data read through the BIO layer is checked before\\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\\n\\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\\nas the affected code is outside the OpenSSL FIPS module boundary.\"},{\"lang\":\"es\",\"value\":\"Resumen del problema: Analizar una estructura ASN.1 codificada en DER manipulada con un elemento primitivo cuyo contenido excede los 2 gigabytes de longitud puede causar una lectura excesiva del b\u00fafer de la pila (heap buffer over-read) en plataformas Unix y similares a Unix de 64 bits.\\n\\nResumen del impacto: La lectura excesiva del b\u00fafer de la pila puede bloquear la aplicaci\u00f3n (Denegaci\u00f3n de Servicio) o cargar en el objeto ASN.1 decodificado contenidos de memoria m\u00e1s all\u00e1 del final del b\u00fafer de entrada. M\u00e1s t\u00edpicamente, tales elementos ASN.1 ser\u00edan truncados en su lugar.\\n\\nUn truncamiento de entero en el decodificador ASN.1 de OpenSSL hace que la longitud del contenido de un elemento primitivo ASN.1 sea manejada incorrectamente cuando excede los 2 gigabytes. En el peor de los casos, la longitud truncada se trata como una solicitud para escanear el contenido binario en busca de un byte cero de terminaci\u00f3n, posiblemente causando que OpenSSL lea menos o m\u00e1s all\u00e1 del final del b\u00fafer asignado.\\n\\nLas aplicaciones que pasan datos suministrados por el atacante a d2i_X509(), d2i_PKCS7(), o cualquier otra funci\u00f3n de decodificaci\u00f3n d2i_* se ven afectadas. Las propias herramientas de l\u00ednea de comandos de OpenSSL no son vulnerables, ya que los datos le\u00eddos a trav\u00e9s de la capa BIO se verifican antes de que lleguen al c\u00f3digo afectado. El problema solo afecta a plataformas Unix y similares a Unix de 64 bits; las plataformas de 32 bits y Windows de 64 bits no se ven afectadas.\\n\\nLos m\u00f3dulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que el c\u00f3digo afectado est\u00e1 fuera del l\u00edmite del m\u00f3dulo FIPS de OpenSSL.\"}],\"affected\":[{\"source\":\"openssl-security@openssl.org\",\"affectedData\":[{\"vendor\":\"OpenSSL\",\"product\":\"OpenSSL\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.0.0\",\"lessThan\":\"4.0.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThan\":\"3.6.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"lessThan\":\"3.5.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"lessThan\":\"3.4.6\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.0.0\",\"lessThan\":\"3.0.21\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.1.1\",\"lessThan\":\"1.1.1zh\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"1.0.2\",\"lessThan\":\"1.0.2zq\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-09T19:00:59.503895Z\",\"id\":\"CVE-2026-34180\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndExcluding\":\"1.0.2zq\",\"matchCriteriaId\":\"F534B804-67B6-49DA-8A86-0FF21E512908\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1\",\"versionEndExcluding\":\"1.1.1zh\",\"matchCriteriaId\":\"43EFE1E3-4049-4EE6-A2AE-BDBA38E6870F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.21\",\"matchCriteriaId\":\"EDB88756-EDFE-4886-A267-3F19342A6042\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndExcluding\":\"3.4.6\",\"matchCriteriaId\":\"BF7E21E7-AEC0-4882-B1F1-2D056B506F22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.5.0\",\"versionEndExcluding\":\"3.5.7\",\"matchCriteriaId\":\"6B6B9930-C549-4D88-9784-AF32CCDDB87A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndExcluding\":\"3.6.3\",\"matchCriteriaId\":\"D41B3C45-EC73-4DC8-989D-B2E2792E102F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E881B9A-1A0A-4BC0-8160-20C00561167D\"}]}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://openssl-library.org/news/secadv/20260609.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T12:10:53+00:00",
      "cve": "CVE-2026-34180",
      "id": "CVE-2026-34180",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:fixed": "103",
      "product_status:known_affected": "62",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34180.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T16:33:07Z",
      "cve": "CVE-2026-34180",
      "id": "CVE-2026-34180",
      "initial_release_date": "2026-06-13T02:21:19Z",
      "product_status:known_affected": "503",
      "product_status:known_not_affected": "84",
      "product_status:recommended": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-34180",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-34180.json",
      "version": "14"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34180\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-09T19:00:59.503895Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-09T19:02:17.689Z\"}}], \"cna\": {\"title\": \"Heap Buffer Over-read in ASN.1 Content Parsing\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Frank Buss\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Viktor Dukhovni\"}], \"metrics\": [{\"other\": {\"type\": \"https://openssl-library.org/policies/general/security-policy/\", \"content\": {\"text\": \"Low\"}}, \"format\": \"other\"}], \"affected\": [{\"vendor\": \"OpenSSL\", \"product\": \"OpenSSL\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.1\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"lessThan\": \"3.6.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.5.0\", \"lessThan\": \"3.5.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"3.4.6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.21\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1zh\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.0.2\", \"lessThan\": \"1.0.2zq\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-09T14:00:00.000Z\", \"references\": [{\"url\": \"https://openssl-library.org/news/secadv/20260609.txt\", \"name\": \"OpenSSL Advisory\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16\", \"name\": \"4.0.1 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff\", \"name\": \"3.6.3 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43\", \"name\": \"3.5.7 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d\", \"name\": \"3.4.6 git commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83\", \"name\": \"3.0.21 git commit\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\\nover-read on 64-bit Unix and Unix-like platforms.\\n\\nImpact summary: The heap buffer over-read may crash the application (Denial of\\nService) or to load into the decoded ASN.1 object contents of memory beyond the\\nend of the input buffer.  More typically such ASN.1 elements would instead be\\ntruncated.\\n\\nAn integer truncation in OpenSSL\u0027s ASN.1 decoder causes the content length of\\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\\nworst case the truncated length is treated as a request to scan the binary\\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\\nless than or beyond the end of the allocated buffer.\\n\\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\\nany other d2i_* decoding function are affected. OpenSSL\u0027s own command-line\\ntools are not vulnerable, as data read through the BIO layer is checked before\\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\\n\\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\\nas the affected code is outside the OpenSSL FIPS module boundary.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\u003cbr\u003eelement whose content exceeds 2 gigabytes in length may cause a heap buffer\u003cbr\u003eover-read on 64-bit Unix and Unix-like platforms.\u003cbr\u003e\u003cbr\u003eImpact summary: The heap buffer over-read may crash the application (Denial of\u003cbr\u003eService) or to load into the decoded ASN.1 object contents of memory beyond the\u003cbr\u003eend of the input buffer.  More typically such ASN.1 elements would instead be\u003cbr\u003etruncated.\u003cbr\u003e\u003cbr\u003eAn integer truncation in OpenSSL\u0027s ASN.1 decoder causes the content length of\u003cbr\u003ean ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\u003cbr\u003eworst case the truncated length is treated as a request to scan the binary\u003cbr\u003econtent for a terminating zero byte, possibly causing OpenSSL to read either\u003cbr\u003eless than or beyond the end of the allocated buffer.\u003cbr\u003e\u003cbr\u003eApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\u003cbr\u003eany other d2i_* decoding function are affected. OpenSSL\u0027s own command-line\u003cbr\u003etools are not vulnerable, as data read through the BIO layer is checked before\u003cbr\u003eit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\u003cbr\u003eplatforms; 32-bit platforms and 64-bit Windows are not affected.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\u003cbr\u003eas the affected code is outside the OpenSSL FIPS module boundary.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"shortName\": \"openssl\", \"dateUpdated\": \"2026-06-10T07:47:52.427Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34180\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T07:47:52.427Z\", \"dateReserved\": \"2026-03-26T09:29:36.012Z\", \"assignerOrgId\": \"3a12439a-ef3a-4c79-92e6-6081a721f1e5\", \"datePublished\": \"2026-06-09T16:03:17.082Z\", \"assignerShortName\": \"openssl\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.